linux-kernel - Re: [PATCH] MIPS: reset all task's asid to 0 after asid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 7 Mar 2017 20:06:41 +0800
From:   Jiwei Sun <Jiwei.Sun@...driver.com>
To:     Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
CC:     <linux-mips@...ux-mips.org>, <linux-kernel@...r.kernel.org>,
        <jiwei.sun.bj@...com>
Subject: Re: [PATCH] MIPS: reset all task's asid to 0 after asid_cache(cpu)
 overflows



On 03/06/2017 04:34 PM, Sergei Shtylyov wrote:
> On 3/6/2017 10:21 AM, jsun4 wrote:
> 
>>>> If asid_cache(cpu) overflows, there may be two tasks with the same
>>>> asid. It is a risk that the two different tasks may have the same
>>>> address space.
>>>>
>>>> A process will update its asid to newer version only when switch_mm()
>>>> is called and matches the following condition:
>>>>     if ((cpu_context(cpu, next) ^ asid_cache(cpu))
>>>>                     & asid_version_mask(cpu))
>>>>             get_new_mmu_context(next, cpu);
>>>> If asid_cache(cpu) overflows, cpu_context(cpu,next) and asid_cache(cpu)
>>>> will be reset to asid_first_version(cpu), and start a new cycle. It
>>>> can result in two tasks that have the same ASID in the process list.
>>>>
>>>> For example, in CONFIG_CPU_MIPS32_R2, task named A's asid on CPU1 is
>>>> 0x100, and has been sleeping and been not scheduled. After a long period
>>>> of time, another running task named B's asid on CPU1 is 0xffffffff, and
>>>> asid cached in the CPU1 is 0xffffffff too, next task named C is forked,
>>>> when schedule from B to C on CPU1, asid_cache(cpu) will overflow, so C's
>>>> asid on CPU1 will be 0x100 according to get_new_mmu_context(). A's asid
>>>> is the same as C, if now A is rescheduled on CPU1, A's asid is not able
>>>> to renew according to 'if' clause, and the local TLB entry can't be
>>>> flushed too, A's address space will be the same as C.
>>>>
>>>> If asid_cache(cpu) overflows, all of user space task's asid on this CPU
>>>> are able to set a invalid value (such as 0), it will avoid the risk.
>>>>
>>>> Signed-off-by: Jiwei Sun <jiwei.sun@...driver.com>
>>>> ---
>>>>  arch/mips/include/asm/mmu_context.h | 9 ++++++++-
>>>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
>>>> index ddd57ad..1f60efc 100644
>>>> --- a/arch/mips/include/asm/mmu_context.h
>>>> +++ b/arch/mips/include/asm/mmu_context.h
>>>> @@ -108,8 +108,15 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
>>>>  #else
>>>>          local_flush_tlb_all();    /* start new asid cycle */
>>>>  #endif
>>>> -        if (!asid)        /* fix version if needed */
>>>> +        if (!asid) {        /* fix version if needed */
>>>> +            struct task_struct *p;
>>>> +
>>>> +            for_each_process(p) {
>>>> +                if ((p->mm))
>>>
>>>    Why double parens?
>>
>> At the beginning, the code was written as following
>>     if ((p->mm) && (p->mm != mm))
>>         cpu_context(cpu, p->mm) = 0;
>>
>> Because cpu_context(cpu,mm) will be changed to asid_first_version(cpu) after 'for' loop,
>> and in order to improve the efficiency of the loop, I deleted "&& (p->mm != mm)",
>> but I forgot to delete the redundant parentheses.
> 
>    Note that parens around 'p->mm' were never needed. And neither around the right operand of &&.

You are right, I will pay attention to similar problems next time.
Thanks for your reminder.

Best regards,
Jiwei

> 
>> Thanks,
>> Best regards,
>> Jiwei
> 
> MBR, Sergei
>